Draft, not legal advice. This page has not been approved or published. Items in [square brackets] are still to be confirmed.
Privacy Policy
Last updated: [date published]
Orgo Sites is run by Reddrop Group Pty Ltd, ABN 70 626 690 622 (“we”, “us”). We follow the Australian Privacy Principles in the Privacy Act 1988. This page explains what personal information we collect, why, who sees it, and how you can ask us about it.
What we collect
Prospects (businesses we email about a demo site):
- Business name, business email address, phone number, address, public website and social links, and publicly listed details such as services and photos.
- Where we found your email (the web page or listing), so we can show we had a reason to contact you.
- Whether you replied or asked us to stop.
Clients (businesses that sign up):
- Your name, email, phone, business details, and the content you give us for your site (text, photos, logos).
- Sign-in details for the client portal, and messages you send to the portal chat.
- Billing details. Card numbers go straight to Stripe. We never see or store them. We keep invoices, amounts and dates.
Website visitors: [Gavin: confirm. If we add analytics or cookies, list them here. Today: only technical logs kept by our hosts, such as IP address and browser type.]
Why we collect it
- To contact a business about a website we built for it, and to stop when asked.
- To build, host, change and support your site, and to run your account.
- To take payment, issue invoices and keep tax records.
- To meet our legal obligations and handle complaints.
We don't sell personal information.
Who we share it with, including overseas
We use service providers to run Orgo. Some store or process data outside Australia.
| Provider | What for | Where |
|---|---|---|
| Vercel | Hosting the website and client portal | USA and global edge locations |
| Supabase | Database, sign-in, file storage | [confirm region, e.g. Sydney] |
| Stripe | Payments and subscriptions | USA, Australia and other countries |
| Cloudflare | Hosting client sites, DNS, security | Global |
| [Resend or Postmark: confirm] | Sending email | USA |
| Anthropic (Claude) | AI that helps us draft and edit site content and answers portal chat | USA |
| [Twenty CRM on Railway: confirm] | Our sales contact records | [confirm] |
We take reasonable steps to make sure these providers handle information in line with the APPs. Content you put in the portal chat may be sent to the AI provider to produce your edits. Please don't put anything sensitive in it.
Keeping it safe
Access is limited to Reddrop Group Pty Ltd and our tools. Client data is separated per client in the database. We keep client records while you're a client and for 7 years after for tax purposes. Prospect records are deleted or reduced to a do-not-contact entry [confirm: 12 months after last contact].
Your rights
- Access and correction: ask us for the information we hold about you and we'll send it or fix it, normally within 30 days.
- Deletion: ask us to delete it. We'll do so unless we must keep it by law (e.g. invoices).
- Stop marketing: reply “stop” or use the unsubscribe link in any email. We add you to a do-not-contact list the same day. (We keep your email on that list so we don't contact you again.)
Contact: [privacy email, e.g. privacy@orgo.site], Reddrop Group Pty Ltd, [postal address].
Complaints
Email us first. We'll reply within 5 working days and try to fix it within 30 days. If you're not satisfied, contact the Office of the Australian Information Commissioner (OAIC): oaic.gov.au, 1300 363 992.
Data breaches
If a breach is likely to cause serious harm, we'll tell you and the OAIC as the Notifiable Data Breaches scheme requires.
Changes
We'll update this page and its date when things change.